Debian DLA-2635-1 : libspring-java security update

Multiple vulnerabilities were discovered in libspring-java, a modular Java/J2EE application framework. An attacker may execute code, perform XST attack, issue unauthorized cross-domain requests or cause a DoS denial of service in specific configurations. CVE-2018-1270 Spring Framework allows...

Debian: Security Advisory (DLA-2635-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2635-1] libspring-java security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2635-1 [email protected] https://www.debian.org/lts/security/ April 23, 2021 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package...

ai.foremast.metrics:foremast-spring-4x-k8s-metrics (>=0.1.6, <=0.2.0), am.ik.blog:blog-domain (>=4.0.2, <=4.3.6) +10761 more potentially affected by CVE-2018-11040 via org.springframework:spring-core (>=4.3.0.release, <=4.3.17.release)

org.springframework:spring-core MAVEN version =4.3.0.release, =0.1.6, =4.0.2, =4.0.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0.release, =0.2, =0.2, =0.2, =0.3 - at.researchstudio.sat:won-matcher 0.3 - at.researchstudio.sat:won-matcher-rescal 0.3 - at.researchstudio.sat:won-matcher-service 0.3 and...

ai.foremast.metrics:foremast-spring-4x-k8s-metrics (>=0.1.6, <=0.2.0), am.ik.blog:blog-domain (>=4.0.2, <=4.3.6) +10761 more potentially affected by CVE-2018-11040 via org.springframework:spring-core (>=4.3.0.release, <=4.3.17.release)

org.springframework:spring-core MAVEN version =4.3.0.release, =0.1.6, =4.0.2, =4.0.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0.release, =0.2, =0.2, =0.2, =0.3 - at.researchstudio.sat:won-matcher 0.3 - at.researchstudio.sat:won-matcher-rescal 0.3 - at.researchstudio.sat:won-matcher-service 0.3 and...

ai.dev-tools:ai-devtools (>=0.1.12, <=0.1.20), ai.idylnlp:idylnlp-models-deeplearning (>=1.0.0, <=1.1.0) +2900 more potentially affected by CVE-2018-11040 via org.springframework:spring-core (>=5.0.0.release, <=5.0.6.release)

org.springframework:spring-core MAVEN version =5.0.0.release, =0.1.12, =1.0.0, =0.0.1, =0.0.2, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =0.0.1, =1.0.0, =0.0.1, =1.0.0, =2.0.1 - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 and more Source cves: CVE-2018-11040 Source advisory: OSV:GHSA-F26X-PR96-VW86...

CVE-2018-11040

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP JSON with Padding through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser...

CVE-2018-11040

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP JSON with Padding through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser...

CVE-2018-11040

CVE-2018-11040 affects Spring Framework: 5.0.x before 5.0.7 and 4.3.x before 4.3.18 (and older unsupported versions). The issue arises because JSONP support can be enabled via JSONP parameters when MappingJackson2JsonView is configured, allowing cross-domain requests through AbstractJsonpResponse...

ai.foremast.metrics:foremast-spring-4x-k8s-metrics (>=0.1.6, <=0.2.0), am.ik.blog:blog-domain (>=4.0.2, <=4.3.6) +10761 more potentially affected by CVE-2018-11040 via org.springframework:spring-core (>=4.3.0.release, <=4.3.17.release)

org.springframework:spring-core MAVEN version =4.3.0.release, =0.1.6, =4.0.2, =4.0.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0.release, =0.2, =0.2, =0.2, =0.3 - at.researchstudio.sat:won-matcher 0.3 - at.researchstudio.sat:won-matcher-rescal 0.3 - at.researchstudio.sat:won-matcher-service 0.3 and...

ai.dev-tools:ai-devtools (>=0.1.12, <=0.1.20), ai.idylnlp:idylnlp-models-deeplearning (>=1.0.0, <=1.1.0) +2900 more potentially affected by CVE-2018-11040 via org.springframework:spring-core (>=5.0.0.release, <=5.0.6.release)

org.springframework:spring-core MAVEN version =5.0.0.release, =0.1.12, =1.0.0, =0.0.1, =0.0.2, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =0.0.1, =1.0.0, =0.0.1, =1.0.0, =2.0.1 - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 and more Source cves: CVE-2018-11040 Source advisory: MEND:CVE-2018-11040...